x/vulndb: potential Go vuln in github.com/moby/moby: CVE-2018-15664

[tatianab]

CVE-2018-15664 references github.com/moby/moby, which may be a Go module.

Description:
In Docker through 18.06.1-ce-rc2, the API endpoints behind the 'docker cp' command are vulnerable to a symlink-exchange attack with Directory Traversal, giving attackers arbitrary read-write access to the host filesystem with root privileges, because daemon/archive.go does not do archive operations on a frozen filesystem (or from within a chroot).

References:

• NIST: https://nvd.nist.gov/vuln/detail/CVE-2018-15664
• web: https://bugzilla.suse.com/show_bug.cgi?id=1096726
• fix: daemon: archive: pause containers before doing filesystem operations moby/moby#39252
• web: http://www.openwall.com/lists/oss-security/2019/05/28/1
• web: http://www.securityfocus.com/bid/108507
• web: http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00066.html
• web: https://usn.ubuntu.com/4048-1/
• web: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-15664
• web: https://access.redhat.com/errata/RHSA-2019:1910
• web: http://www.openwall.com/lists/oss-security/2019/08/21/1
• web: http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00001.html
• Imported by: https://pkg.go.dev/github.com/moby/moby?tab=importedby

Cross references:

• Module github.com/moby/moby appears in issue x/vulndb: potential Go vuln in github.com/moby/moby: CVE-2022-24769 #390 EFFECTIVELY_PRIVATE
• Module github.com/moby/moby appears in issue x/vulndb: potential Go vuln in github.com/moby/moby: GHSA-8fvr-5rqf-3wwh #638 NOT_IMPORTABLE
• Module github.com/moby/moby appears in issue x/vulndb: potential Go vuln in github.com/moby/moby: GHSA-v4h8-794j-g8mm #708 NOT_IMPORTABLE
• Module github.com/moby/moby appears in issue x/vulndb: potential Go vuln in github.com/moby/moby: GHSA-vj3f-3286-r4pf #751 NOT_IMPORTABLE
• Module github.com/moby/moby appears in issue x/vulndb: potential Go vuln in github.com/moby/moby: CVE-2022-36109 #985 NOT_IMPORTABLE
• Module github.com/moby/moby appears in issue x/vulndb: potential Go vuln in github.com/moby/moby: GHSA-vp35-85q5-9f25 #1107 NOT_IMPORTABLE
• Module github.com/moby/moby appears in issue x/vulndb: potential Go vuln in github.com/moby/moby: CVE-2023-28840 #1699 EFFECTIVELY_PRIVATE
• Module github.com/moby/moby appears in issue x/vulndb: potential Go vuln in github.com/moby/moby: CVE-2023-28841 #1700 EFFECTIVELY_PRIVATE
• Module github.com/moby/moby appears in issue x/vulndb: potential Go vuln in github.com/moby/moby: CVE-2023-28842 #1701 EFFECTIVELY_PRIVATE

See doc/triage.md for instructions on how to triage this report.

modules:
    - module: github.com/moby/moby
      vulnerable_at: 24.0.7+incompatible
      packages:
        - package: n/a
cves:
    - CVE-2018-15664
references:
    - web: https://bugzilla.suse.com/show_bug.cgi?id=1096726
    - fix: https://github.com/moby/moby/pull/39252
    - web: http://www.openwall.com/lists/oss-security/2019/05/28/1
    - web: http://www.securityfocus.com/bid/108507
    - web: http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00066.html
    - web: https://usn.ubuntu.com/4048-1/
    - web: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-15664
    - web: https://access.redhat.com/errata/RHSA-2019:1910
    - web: http://www.openwall.com/lists/oss-security/2019/08/21/1
    - web: http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00001.html

[gopherbot]

Change https://go.dev/cl/540721 mentions this issue: data/excluded: batch add 135 excluded reports